Convert BrowserRequestForgery.ql to to use the new dataflow API

Author: Jami Cogswell

javascript/lib/browserextension/BothSidesRequestForgeryQuery.qll

@@ -16,31 +16,30 @@
   * A taint tracking configuration for client-side request forgery.
   * Server side is disabled since this is in the browser, but the extra models can be enabled for extra coverage
   */
- class Configuration extends TaintTracking::Configuration {
-   Configuration() { this = "ClientSideRequestForgery" }
- 
-   override predicate isSource(DataFlow::Node source) {
+ module Config implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) {
      exists(Source src |
        source = src and
        not src.isServerSide()
      ) or 
     source instanceof OnMessageExternal or source instanceof OnConnectExternal
    }
 
-   override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
 
-   override predicate isSanitizer(DataFlow::Node node) {
-     super.isSanitizer(node) or
+  predicate isBarrier(DataFlow::Node node) {
      node instanceof Sanitizer
    }
 
-   override predicate isSanitizerOut(DataFlow::Node node) { sanitizingPrefixEdge(node, _) }
+  predicate isBarrierOut(DataFlow::Node node) { sanitizingPrefixEdge(node, _) }
 
-   override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+  predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
      isAdditionalRequestForgeryStep(pred, succ)
    }
   }
 
+  module ConfigFlow = TaintTracking::Global<Config>;
+
   class BrowserStep extends DataFlow::SharedFlowStep {
     override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
       (exists (DataFlow::ParameterNode p |

javascript/src/audit/CWE-918/BrowserRequestForgery.ql

@@ -13,11 +13,11 @@
 
  import javascript
  import browserextension.BothSidesRequestForgeryQuery
- import DataFlow::PathGraph
+ import ConfigFlow::PathGraph
 
- from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, DataFlow::Node request
+ from ConfigFlow::PathNode source, ConfigFlow::PathNode sink, DataFlow::Node request
  where
-   cfg.hasFlowPath(source, sink) and
+   ConfigFlow::flowPath(source, sink) and
    request = sink.getNode().(Sink).getARequest()
  select request, source, sink, "The $@ of this request depends on a $@.", sink.getNode(),
    sink.getNode().(Sink).getKind(), source, "user-provided value"